briiirussell/cybersecurity-skills
30 skills3.8k installs10.2k starsGitHub
Install
npx skills add https://github.com/briiirussell/cybersecurity-skillsSkills in this repo
1Owasp AuditThis skill performs a systematic security audit of application source code against the OWASP Top 10 (2021). A developer uses it to map entry points and data flows, then grep and read for patterns across broken access control, cryptographic failures, injection, SSRF, and the other categories. It calls out non-obvious surfaces like server actions, loaders, and resolvers, plus IDOR via foreign keys in mutation payloads.170installs2Osint ReconThis skill systematically gathers, analyzes, and correlates publicly available information from open sources for authorized investigations, threat intelligence, and attack-surface assessment. A developer or analyst uses it to map a target's domains, infrastructure, organization, emails, documents, and threat-feed exposure using only public data. It enforces an ethics check and rates each finding's confidence by corroboration.159installs3Mobile AuditThis skill audits iOS and Android mobile applications against the OWASP MASVS and MASTG standards. A developer uses it to review sensitive-data storage, cryptography, network communication, authentication, and platform interaction such as deeplinks and IPC. It combines source-code review, static analysis of compiled binaries, and runtime testing, gated by an authorization check.149installs4Dependency AuditThis skill audits a project's dependencies, frameworks, language runtimes, and dev tooling for known vulnerabilities, CVEs, and supply-chain risks. A developer runs it to inventory package manifests across ecosystems, execute the correct audit command, and triage findings by reachability and prod-vs-dev impact. It flags cases where npm audit fix --force resolves an advisory by downgrading a package rather than patching it.147installs5Web PentestWeb Pentest is a Claude skill for structured black-box or grey-box penetration testing of a live web application against an authorized target. It follows the OWASP Web Security Testing Guide across configuration, identity, authentication, authorization, and session-management phases, with Burp Suite and ZAP workflows. A developer or tester uses it once they have a target and credentials to probe for auth bypass, IDOR, and business-logic flaws. It requires explicit written authorization before touching the target.143installs6Prompt InjectionThis skill audits applications with AI features, LLM integrations, or agents for prompt injection, permission-boundary bypass, and privilege escalation. A developer uses it to map every place AI is used, trace user and external data into prompts, and check output handling and tool-calling for unsafe patterns. It covers direct, indirect, and cross-privilege injection and treats prompt injection as the top LLM-app vulnerability.141installs7ReconThis skill performs structured reconnaissance and attack-surface enumeration against an authorized target for penetration tests, CTF challenges, and bug bounty programs. A developer or tester uses it to run passive recon such as DNS, WHOIS, and certificate-transparency enumeration, then active recon such as port scanning and web content discovery, and prioritize findings by impact and exposure. It requires written authorization and stays strictly in scope.141installs8Api AuditAPI Audit performs a systematic security audit of REST, GraphQL, and RPC APIs against the OWASP API Security Top 10 (2023). A developer uses it to review every endpoint for broken object-level authorization, broken authentication, excessive data exposure, mass assignment, resource-consumption limits, and SSRF. It is surface-driven over the API contract with specific grep patterns and bypass checks per category.140installs9Disk ForensicsThis skill analyzes disk images, file systems, and memory captures to recover digital evidence and reconstruct timelines for forensic investigations and CTF challenges. A developer or investigator uses it to verify image integrity, mount read-only, list and carve deleted files, extract artifacts, and build a unified event timeline. It requires a confirmed lawful basis and preserves chain of custody before any analysis.140installs10Incident TriageThis skill guides rapid triage and initial response to security incidents using NIST SP 800-61 methodology. A developer or responder uses it to classify an incident's type and severity, contain it without destroying volatile evidence, preserve artifacts in volatility order, and extract indicators of compromise. It outputs a structured triage report with a timeline, IOCs, containment actions, and an escalation checklist.138installs11Cloud AuditCloud Audit reviews cloud infrastructure across AWS, GCP, and Azure for misconfigurations, excessive permissions, and public exposure. A developer or platform engineer uses it to check IAM, network rules, storage, compute, logging, and secrets against security best practices. It provides provider-specific CLI commands and IaC grep patterns, and formats findings into a prioritized action plan.136installs12Secrets AuditSecrets Audit is a Claude skill that finds leaked credentials in source code, Git history, build artifacts, and infrastructure, and audits the secrets-management posture that prevents future leaks. It provides grep patterns for known provider key prefixes and points to tools like gitleaks, trufflehog, and detect-secrets. A developer uses it to sweep a repo for exposed keys and to set up rotation and vaulting. It also covers triaging a found secret from verification through rotation and cleanup.135installs13Finding TriageFinding Triage is an agent skill for solo builders and small teams who receive a steady stream of security noise and need one defensible answer per item—not another dashboard. It walks a single finding from any source through reality checks, severity in your environment, and a clear next action: fix, defer with plan, accept with written risk, or document why it is a false positive. The workflow mirrors enterprise audit habits (including compatibility with OWASP-audit style dispositions) so your agent output can drop straight into Jira, Linear, or compliance packets. Allowed tools include read/search of the repo, optional web lookup for advisories, and shell when you need to verify exploitability. Use it when a scanner email, dependency bot, or pentest line item lands and someone asks whether you should fix it this sprint, accept it, or close it as noise—without improvising legal or security language in chat.126installs14Threat ModelingThreat Modeling is a Claude skill for running a structured, design-time security session against a proposed feature, system, or architecture. It uses STRIDE, attack trees, data flow diagrams, and abuse cases, working through Shostack's four questions. A developer uses it before code is written, when adding auth, payments, multi-tenant data, or a new integration. It surfaces threats and mitigations while the design is still a diagram rather than shipped code.125installs15Privacy EngineeringThis skill implements and audits privacy controls at the code, data, and infrastructure layers for GDPR, CCPA/CPRA, LGPD, and PIPEDA. A developer uses it to classify data, enforce minimization, document lawful basis, and build technical paths for data-subject access requests and deletion across backups, caches, analytics, and third parties. It frames privacy as protecting against authorized-but-improper use, distinct from security.124installs16Crypto AuditCrypto Audit reviews how cryptography is implemented in an application, covering algorithm and mode choice, key sizes, KDF parameters, IV and nonce handling, signature verification, randomness, and TLS configuration. A developer uses it when checking whether crypto is done right, deeper than the obvious MD5 or VERIFY_NONE cases. It supplies correct-vs-reject algorithm guidance and grep patterns for common implementation bugs.122installs17Iam AuditThis skill reviews, designs, and migrates identity and access management across cloud provider IAM, identity providers, and application authorization. A developer uses it to find least-privilege gaps such as privilege creep, role explosion, and shadow-admin escalation paths, or to design greenfield IAM and plan SSO consolidation. It spans AWS, GCP, and Azure IAM, Okta/Entra/Auth0, and RBAC/ABAC/ReBAC patterns.122installs18Siem DetectionSIEM Detection is a Claude skill for engineering and auditing SIEM detection rules. It covers log-source coverage assessment, rule authoring across Sigma, KQL, SPL, and Elastic, MITRE ATT&CK mapping, false-positive tuning, and detection-as-code workflows. A detection engineer uses it to decide what can be detected, write and tune the rules, and manage them in Git. It is the engineering layer distinct from live alert triage and running a SOC.122installs19Vuln ResearchVuln Research is a Claude skill that researches a specific CVE end-to-end to decide whether it actually matters for your code. It pulls canonical sources (NVD, vendor advisory, GitHub advisory, CISA KEV, EPSS), confirms affected versions, maps the package to your environment, and runs reachability analysis. A developer uses it when a CVE drops and they need to decide whether to drop everything and patch. It also covers checking for public PoCs and choosing patch, mitigate, or accept-risk.121installs20Red Team EngagementRed Team Engagement is a Claude skill for planning and executing an authorized, objective-based red-team engagement against systems an organization has contracted to be tested. It walks the engagement lifecycle from pre-engagement scoping through ATT&CK emulation planning, deconfliction with the blue team, and post-engagement debriefs. A developer or security lead uses it to test whether detection and response actually works, not just to find vulnerabilities. It enforces a strict written-authorization check and refuses unauthorized adversary simulation.119installs21Soc OperationsSOC Operations is a Claude skill for building, running, and improving a Security Operations Center. It covers the in-house versus MSSP versus hybrid decision, staffing math, analyst tiering, alert prioritization, runbook authoring, escalation criteria, and MTTD/MTTR KPIs. A security leader uses it to stand up a SOC, run daily triage, or fix a SOC drifting into alert fatigue. It is the operations layer above SIEM detection engineering and incident triage.119installs22Threat HuntingThreat Hunting is a Claude skill for proactive, hypothesis-driven hunts that search SIEM, EDR, and logs for adversaries who have not yet tripped an alert. It follows the PEAK framework (Prepare, Execute, Act, Knowledge) and provides a high-yield hunt catalog for persistence, defense evasion, and lateral movement. A defender uses it to form ATT&CK-based hypotheses, run KQL or SPL queries, and graduate findings into detection rules. It is the proactive layer distinct from reactive incident triage.119installs23Breach PatternsBreach Patterns turns public breach disclosures into audit questions and checks your own stack against them. A developer or security engineer uses it to preemptively harden against known attacker playbooks like Capital One IMDS abuse, SolarWinds supply-chain, LastPass, and Okta push fatigue. For each breach it gives a summary, the audit question it implies, and specific checks that map to other audit skills.118installs24Container AuditContainer Audit reviews container images, Dockerfiles, Helm charts, and Kubernetes manifests for misconfiguration, excessive privilege, exposed secrets, and runtime risks. A developer or platform engineer uses it to harden the container and orchestration layer between cloud IAM and application dependencies. It provides checklists and grep patterns for base images, build-time exposure, pod security context, network policy, secrets, and RBAC.116installs25Pci AuditThis skill audits applications and infrastructure that store, process, or transmit payment card data against PCI DSS v4.0. A developer uses it to determine and reduce scope by tracing payment flows, then audit the engineering-relevant requirements such as protecting stored cardholder data and secure transmission. It emphasizes scope reduction via hosted payment pages and tokenization as the highest-ROI work.115installs26Security CommsSecurity Comms is a Claude skill that translates technical security work into deliverables for non-security audiences such as the board, executives, engineers, customer success, customers, and legal. It defines what each of seven audiences needs and the format and register that lands with them. A security practitioner or founder uses it to turn audit findings, incident write-ups, and threat models into board updates, executive memos, tickets, or customer breach disclosures. It exists to close the gap between technical security output and the people who must act on it.115installs27Csf MappingCSF Mapping assesses a security posture against the NIST Cybersecurity Framework 2.0 across its six functions: Govern, Identify, Protect, Detect, Respond, and Recover. A developer or security lead uses it to produce a gap analysis, current and target tier assessment, and roadmap in governance language for boards, auditors, and CISOs. It provides a per-subcategory methodology and maps other audit skills to the subcategories they inform.114installs28Ai Risk ManagementAI Risk Management applies the NIST AI Risk Management Framework (AI RMF 1.0) and adjacent regulation to AI and ML systems. A developer or governance owner uses it for model lifecycle governance, fairness and bias evaluation, robustness, transparency, drift monitoring, and AI incident response. It walks the four AI RMF functions (Govern, Map, Measure, Manage) and includes an AI-system inventory and per-system context and evaluation steps.112installs29Hipaa AuditThis skill audits applications and infrastructure that create, receive, maintain, or transmit Protected Health Information against HIPAA. A developer uses it to scope ePHI, apply the 18-identifier Safe Harbor list, map the Business Associate Agreement chain, and check the Security Rule's administrative, physical, and technical safeguards. It frames the engineering layer while leaving final compliance determinations to counsel.111installs30Cybersecurity SkillsA collection of cybersecurity skills for AI coding agents. It covers OWASP source-code audits, dependency CVE triage, cloud/IAM/container hardening, recon and OSINT, incident triage, disk forensics, SIEM detection engineering, prompt-injection audits, API security, web pentesting, threat modeling, and mobile/crypto/secrets audits. A developer uses it to audit and harden code and infrastructure before and after shipping.0installs